Main navigation

What is csrf exempt in django – @csrf_exempt ?

Csrf exempt is a cool feature of django which allow bypassing of csrf verification by django.

By default django check for csrf token with each POST request, it verifies csrf to ken before rendering the view. Its a very good security practice to verify csrf of post requests as we know django can’t be compromised in case of security.

Then why we need csrf_exempt??

The answer is simple, to customize django view. In some cases we do not need csrf validations, e.g for public APIs, common AJAX requets, REST APIs.

To suppress csrf verification message, we can use @csrf_exempt decorator for specific view.